Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\sndwgc
Infects the following executable files
- C:\far2\far.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17330.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17340.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6510.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6520.exe
- %ProgramFiles(x86)%\Steam\Steam.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter64.exe
- %ProgramFiles(x86)%\Pidgin\pidgin-uninst.exe
- %ProgramFiles(x86)%\Steam\streaming_client.exe
- %ProgramFiles(x86)%\Steam\WriteMiniDump.exe
- %ProgramFiles(x86)%\Winamp\Elevator.exe
- %ProgramFiles(x86)%\Winamp\Plugins\reporter.exe
- %ProgramFiles(x86)%\Winamp\UninstWA.exe
- %ProgramFiles(x86)%\Winamp\winamp.exe
- %ALLUSERSPROFILE%\Adobe\ARM\S\10428\AdobeARMHelper.exe
- %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10560.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17300.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10540.exe
- %ProgramFiles(x86)%\Steam\GameOverlayUI.exe
- %ProgramFiles(x86)%\Steam\bin\x86launcher.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\thunderbird.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\helper.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\updater.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
- %ALLUSERSPROFILE%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
- %ProgramFiles(x86)%\Steam\uninstall.exe
- %ProgramFiles(x86)%\Opera\launcher.exe
- %ProgramFiles(x86)%\QIP 2012\qip.exe
- %ProgramFiles(x86)%\QIP 2012\unins000.exe
- %ProgramFiles(x86)%\Steam\bin\html5app_steam.exe
- %ProgramFiles(x86)%\Steam\bin\steamservice.exe
- %ProgramFiles(x86)%\Steam\bin\steamwebhelper.exe
- %ProgramFiles(x86)%\Steam\bin\wow_helper.exe
- %ProgramFiles(x86)%\Steam\bin\x64launcher.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Pidgin\pidgin.exe
- %ALLUSERSPROFILE%\Package Cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %APPDATA%\Telegram Desktop\Updater.exe
- %HOMEPATH%\desktop\calc.exe
- %HOMEPATH%\desktop\utorrent.exe
- %HOMEPATH%\desktop\winmine.exe
- %HOMEPATH%\Downloads\ChromeSetup.exe
- %HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega_dlm.exe
- %HOMEPATH%\Downloads\mirc741.exe
- %HOMEPATH%\Downloads\pidgin-2.10.11.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice.exe
- %HOMEPATH%\Downloads\SteamSetup.exe
- %HOMEPATH%\Downloads\tcmd851ax64.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\wrar520.exe
- %APPDATA%\QipGuard\QipGuard_upd.exe
- %ALLUSERSPROFILE%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\VC_redist.x64.exe
- %APPDATA%\qipguard\qipguard.exe
- %ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe
- %ALLUSERSPROFILE%\Package Cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
- <Drive name for removable media>:\skypesetup.exe
- %APPDATA%\ICQM\ICQ\dll\mailrusputnik.exe
- %ALLUSERSPROFILE%\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
- C:\totalcmd\NOCLOSE64.EXE
- C:\totalcmd\tcmadm64.exe
- C:\totalcmd\tcmdx32.exe
- C:\totalcmd\tcunin64.exe
- C:\totalcmd\tcusbrun.exe
- C:\totalcmd\TOTALCMD64.EXE
- %APPDATA%\Mail.Ru\Agent\Mra\dll\mailrusputnik.exe
- %HOMEPATH%\Downloads\Opera_NI_stable.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\crashreporter.exe
- %ProgramFiles(x86)%\mIRC\mirc.exe
- %CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
- %CommonProgramFiles(x86)%\microsoft shared\VS7Debug\vs7jit.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- %CommonProgramFiles(x86)%\Steam\SteamService.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdate.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
- %CommonProgramFiles(x86)%\microsoft shared\Help\dexplore.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- %ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\dsmux.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\gdsmux.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PEVerify.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\setreg.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\sn.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinCV.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinRes.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\wsdl.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\xsd.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\GuiDebug\DbgCLR.exe
- %ProgramFiles(x86)%\mIRC\uninstall.exe
- %ProgramFiles(x86)%\Mozilla Firefox\wow_helper.exe
- %ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-hang-ui.exe
- %ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
- %ProgramFiles(x86)%\Mozilla Firefox\updater.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapp-uninstaller.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PermView.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\Debugger\ManagedDbgCA.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\nmake.exe
- %ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
- %ProgramFiles(x86)%\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\mediainfo.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x86.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\unins000.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapprt-stub.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\Jbimp.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\link.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\AxImp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\certmgr.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\cordbg.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\disco.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\gacutil.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\ildasm.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\mscordmp.exe
- <Drive name for removable media>:\notepad.exe
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following user processes:
- vbc.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- %APPDATA%\sndwgc.exe
- %TEMP%\tmp8fc0.tmp
- %TEMP%\3582-490\vbc.exe
- %WINDIR%\svchost.com
- %CommonProgramFiles%\java\javaup~1\jucheck.exe
- %CommonProgramFiles%\pxstor~1\pxcpya64.exe
- %CommonProgramFiles%\pxstor~1\pxcpyi64.exe
- %CommonProgramFiles%\pxstor~1\pxhpinst.exe
- %CommonProgramFiles%\pxstor~1\pxinsa64.exe
- %CommonProgramFiles%\pxstor~1\pxinsi64.exe
- %ProgramFiles%\winamp\winampa.exe
- %TEMP%\tmp5023.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\sndwgc.exe
Deletes the following files
- %TEMP%\tmp8fc0.tmp
Network activity
Connects to
- '19#.#3.251.109':80
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\SndwgC" /XML "%TEMP%\tmp8FC0.tmp"' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\SndwgC" /XML "%TEMP%\tmp8FC0.tmp"
